The European Data Protection Board (EDPB) recently adopted its opinion on the interplay between the Clinical Trials Regulation 536/2014 (CTR) and the General Data Protection Regulation 2016/679 (GDPR) (the opinion). The opinion was given at the request of the European Commission.
The CTR seeks to harmonise the rules for conducting clinical trials throughout the European Union, and the request for an opinion stemmed from an acknowledgement of the crucial interplay between these two pieces of EU legislation. The EDPB emphasised that interplay by clearing stating in the opinion that the CTR cannot be used as an exemption for compliance with the GDPR.
The opinion distinguishes between the primary use of data and the secondary use of data in clinical trials.
Primary use of data
Primary use includes “all processing operations related to a specific clinical trial protocol during its whole lifecycle, from the starting of the trial to deletion at the end of the archiving period”. There are two main categories of primary processing.
1. Processing for reliability and safety purposes
This is where the CTR or national implementing legislation requires processing for reliability and safety purposes. For example, safety reporting and archiving of clinical trial files.
The appropriate legal basis for this processing is the “legal obligation(s) to which the controller is subject”. In the case of sensitive personal data, this means the processing is “necessary for reasons of public interest in the area of public health”.
2. Processing for research activities
This category covers processing activities that are for research purposes and not required by law. The EDPB identifies four appropriate legal bases: explicit consent, public interest, legitimate interests and, where the data is sensitive, scientific purposes.
Three key distinctions are drawn between consent under the CTR and consent under the GDPR:
- Informed consent to participate in a clinical trial under CTR is to be distinguished from the legal basis of explicit consent under the GDPR.
- Consent under the CTR may not be sufficient under the GDPR: the imbalance of power between a participant and a sponsor may prevent consent from being freely given.
- A withdrawal of informed consent under the CTR is prospective only and shall not affect the activities already carried out and the use of the data obtained based on informed consent before its withdrawal. Contrastingly, withdrawal of consent under the GDPR is retrospective, and all data processing activities based on the consent must stop.
Secondary use of data
Secondary use is the processing of data for scientific purposes, but outside the scope of the clinical trial protocol.
Under the CTR, a separate legal basis is required for the secondary use of data. Where this is consent, this should be sought at the same time as the informed consent to participate in the clinical trial.
However, the EDPB suggests that the GDPR’s presumption of compatibility applies here. Therefore, it is presumed that the secondary use is not incompatible with the original purpose (and thus, is within the scope of the protocol) if the data is processed for archiving purposes in the public interest, scientific research, historical research or statistical purposes, and there are appropriate safeguards.
The EDPB’s opinion provides some clarity on the relationship between the CTR and the GDPR. Sponsors will particularly benefit from the guidance on legal bases.
The interplay between secondary use under the CTR and the GDPR’s presumption of compatibility needs to be addressed further; the EDPB plans to issue guidance on this in the future.
The CTR is expected to enter into force in 2020.